PHP - How To Check For Malicious Php Code

I've been surfing the web and reading various articles, and probably have more questions than answers, so any guidance or direction to resources will (hopefully) be useful.

I'm trying to connect the dots to more adequately understand the security issues within uploading image files.

From its inception, light hits a camera sensor and an image is created. Is it in binary form? ASCII? Other?

Now suppose additional code is added to the image. (For this example, let's say it's a simple script that says Hello - which I suppose would STILL be considered malicious).

If it's simply placed into the image code, how can I open the image (as the recipient) to see the code in its TEXT form?

(I'm assuming that the code would need to be activated either by clicking the script or calling the code in order to actual function)

And if the code is hidden or camouflaged by using an alternate character set, how would it be translated from the unnoticeable character set into something more meaningful in order to perform?

Edited April 20 by phppup
Typos

Hi, I need to insert some code into my current form code which will check to see if a username exist and if so will display an echo message. If it does not exist will post the form (assuming everything else is filled in correctly). I have tried some code in a few places but it doesn't work correctly as I get the username message exist no matter what. I think I am inserting the code into the wrong area, so need assistance as to how to incorporate the username check code.

$sql="select * from Profile where username = '$username';
$result = mysql_query( $sql, $conn )
      or die( "ERR: SQL 1" );
if(mysql_num_rows($result)!=0)
{
process form
}
else
{
echo "That username already exist!";
}


the current code of the form


<?PHP
//session_start();
require_once "formvalidator.php";
$show_form=true;

if (!isset($_POST['Submit'])) {



$human_number1 = rand(1, 12);



$human_number2 = rand(1, 38);



$human_answer = $human_number1 + $human_number2;



$_SESSION['check_answer'] = $human_answer;
}

if(isset($_POST['Submit']))
{





if (!isset($_SESSION['check_answer'])) {
echo "<p>Error: Answer session not set</p>";
}


if($_POST['math'] != $_SESSION['check_answer']) {
echo "<p>You did not pass the human check.</p>";
exit();
}


   $validator = new FormValidator();
    $validator->addValidation("FirstName","req","Please fill in FirstName");







$validator->addValidation("LastName","req","Please fill in LastName");
$validator->addValidation("UserName","req","Please fill in UserName");
$validator->addValidation("Password","req","Please fill in a Password");
$validator->addValidation("Password2","req","Please re-enter your password");
$validator->addValidation("Password2","eqelmnt=Password","Your passwords do not match!");
$validator->addValidation("email","email","The input for Email should be a valid email value");
$validator->addValidation("email","req","Please fill in Email");
$validator->addValidation("Zip","req","Please fill in your Zip Code");
$validator->addValidation("Security","req","Please fill in your Security Question");
$validator->addValidation("Security2","req","Please fill in your Security Answer");
    if($validator->ValidateForm())
    {
        $con = mysql_connect("localhost","uname","pw") or die('Could not connect: ' . mysql_error());
        mysql_select_db("beatthis_beatthis") or die(mysql_error());
$FirstName=mysql_real_escape_string($_POST['FirstName']); //This value has to be the same as in the HTML form file
$LastName=mysql_real_escape_string($_POST['LastName']); //This value has to be the same as in the HTML form file
$UserName=mysql_real_escape_string($_POST['UserName']); //This value has to be the same as in the HTML form file
$Password= md5($_POST['Password']); //This value has to be the same as in the HTML form file
$Password2= md5($_POST['Password2']); //This value has to be the same as in the HTML form file
$email=mysql_real_escape_string($_POST['email']); //This value has to be the same as in the HTML form file
$Zip=mysql_real_escape_string($_POST['Zip']); //This value has to be the same as in the HTML form file
$Birthday=mysql_real_escape_string($_POST['Birthday']); //This value has to be the same as in the HTML form file
$Security=mysql_real_escape_string($_POST['Security']); //This value has to be the same as in the HTML form file
$Security2=mysql_real_escape_string($_POST['Security2']); //This value has to be the same as in the HTML form file



$sql="INSERT INTO Profile (`FirstName`,`LastName`,`Username`,`Password`,`Password2`,`email`,`Zip`,`Birthday`,`Security`,`Security2`) VALUES ('$FirstName','$LastName','$UserName','$Password','$Password2','$email','$Zip','$Birthday','$Security','$Security2')"; 
//echo $sql;
if (!mysql_query($sql,$con)) {

 die('Error: ' . mysql_error());

} else{



mail('email@gmail.com','A profile has been submitted!',$FirstName.' has submitted their profile',$body);

echo "<h3>Your profile information has been submitted successfully.</h3>";
}

mysql_close($con);
        $show_form=false;
    }
    else
    {
        echo "<h3 class='ErrorTitle'>Validation Errors:</h3>";

        $error_hash = $validator->GetErrors();
        foreach($error_hash as $inpname => $inp_err)
        {
            echo "<p class='errors'>$inpname : $inp_err</p>\n";
        }        
    }
}

if(true == $show_form)
{
?>

basically this is a search function


<form  method="post" action="test1.php">
<input type = "hidden" name="submitted" value ="true" />
  <label>TYPE:
  <select name="field">
    <option value = "sid">StudentID</option>
    <option value = "sname">StudentName</option>
  </select>
  </label>
  <label>WORD:
  <input type="text" name="searchword" />
  </label>
<input type="submit"  />
</form>


-------------
<?php
if (isset($_POST['submitted'])){

$con = mysql_connect("localhost","root","");

  mysql_select_db("uni", $con);
  

$field= $_POST['field'];
$searchword = $_POST['searchword'];
$query = "SELECT* FROM student WHERE $field = '$searchword'";
$result = mysqli_query($con,$query) or die ('error data'); //-----------> error line

echo"<table>";
echo "<tr><th>StudentID</th><th>StudentName</th></tr>";
while($row = mysqli_fetch_array($result)){

echo "<tr><td>";
echo "$row ['sid']";
echo "</td><td>";
echo "$row ['sname']";
echo "</td></tr>";
}

echo"</table>";

}

mysql_close($con);

?>


NB: the error message "Warning: mysqli_query() expects parameter 1 to be mysqli, resource given in C:\wamp\www\test1.php on line 21
error data"

I am new to PHP.

I developed this class, I wonder if there's anything wrong or that I can improve. I could not test it because I'm in school.

Thanks in advance.

Code: [Select]
<?



class user {



var $userID,

$schoolID,

$userName,

$userPass,

$dbHost,

$dbUser,

$dbName,

$dbPass,

$dbUserTable;

$dbSchoolTable;



function dbInfo() {

$this->dbHost = 'localhost';

$this->dbUser = '';

$this->dbName = '';

$this->dbPass = '';

$this->dbUserTable = '';

$this->dbSchoolTable = '';

}



function registerUser($userName, $userPass) {

$dbLink = mysql_connect($this->dbHost, $this->dbUser, $this->dbPass);

if(!$dbLink) die("Could not connect to database: " . mysql_error());



mysql_select_db($this->dbName);



$query = "INSERT INTO $this->dbUserTable VALUES (NULL, \"$userName\", \"$userPass\")";

$result = mysql_query($query);



if(!$result) {
echo "Fail.";
} else {
$this->userID = mysql_insert_id();
}



mysql_close($dbLink);



$this->userName = $userName;

$this->userPass = $userPass;

}



function registerSchool($schoolName) {

$dbLink = mysql_connect($this->dbHost, $this->dbUser, $this->dbPass);

if(!$dbLink) die("Could not connect to database: " . mysql_error());



mysql_select_db($this->dbName);



$query = "INSERT INTO $this->dbSchoolTable VALUES (NULL, \"$schoolName\")";

$result = mysql_query($query);



if(!$result) {
echo "Fail.";
} else {
$this->schoolID = mysql_insert_id();
}



mysql_close($dbLink);



$this->schoolName = $schoolName;

}


function userLogin() {

$dbLink = mysql_connect($this->dbHost, $this->dbUser, $this->dbPass);

if(!$dbLink) die("Could not connect to database: " . mysql_error());



mysql_select_db($this->dbName);



$query = "SELECT * FROM $this->dbUserTable WHERE userName = \"$this->userName\" AND userPass = \"$this->userPass\" LIMIT 1";

$result = mysql_query($query);



if(!$result) {
echo "Fail.";
} else {
while($row = mysql_fetch_array($result)) {
session_start();
$_SESSION['userID'] = $row['userID'];
session_write_close();
}
}



mysql_close($dbLink);

}


function changePass($newPass) {

$dbLink = mysql_connect($this->dbHost, $this->dbUser, $this->dbPass);

if(!$dbLink) die("Could not connect to database: " . mysql_error());



mysql_select_db($this->dbName);

$query = "SELECT * FROM $this->dbUserTable WHERE userName = \"$this->userName\" LIMIT 1";

$result = mysql_query($query);

if(!$result) {
echo "Fail.";
} else {

$query = "UPDATE $this->dbUserTable SET userPass = \"$newPass\" WHERE userName = \"$this->userName\"";

$result = mysql_query($query);



if(!$result) {
echo "Fail";
} else {
$this->userPass = $newPass;
}
}



mysql_close($dbLink);

}



}

?>